Executive Summary
In September 2026, a threat actor successfully exfiltrated 68.837 GiB of database backups from a Philippine government agency responsible for overseas employment. The theft was discovered via an exposed staging server on port 80 (UpCloud Singapore) that left the operator's toolkit, logs, and transfer records accessible to the public. The exfiltrated data included 27 SQL Server backups with filenames corresponding to critical migrant worker systems such as POEA and OFW variants.
The technical analysis revealed the use of 'Wrqsnx,' a rebranded version of the GodPotato privilege escalation tool, accompanied by an 8-line PowerShell stager designed to load payloads reflectively from memory. A full Impacket environment was also staged, indicating the actor's intent to perform lateral movement and credential dumping. Although the exfiltration was completed, the initial access vector remains unconfirmed, though staging logs show delivery attempts to several internal agency portal hosts.
This incident highlights the significant risk of database backup theft and the continued efficacy of publicly available privilege escalation tools like GodPotato when rebranded to evade static signatures. The exposure of the operator's own staging environment provided rare visibility into the specific database names and infrastructure involved in the Philippine government breach.